CVE-2019-7299

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
WP Support Plus Responsive Ticket System
Vendor
CVE Published:
21 March 2019

Summary

A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the subject parameter in wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/ajax/submit_ticket.php.

References

https://cert.kalasag.com.ph/news/research/cve-2019-7299-s...
x_refsource_MISC
https://wordpress.org/plugins/wp-support-plus-responsive-...
x_refsource_MISC
https://wpvulndb.com/vulnerabilities/9235
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.